Rocket Lazy Load CVE-2026-105884

Exploitation requires (1) an authenticated WordPress account with at least low privileges able to submit content through the Rocket Lazy Load plugin on an affected site (versions up to and including 2.4.0), and (2) a victim user - typically an administrator or another visitor - subsequently rendering the page containing the stored payload (UI:R). These two factors (authentication plus mandatory victim interaction) are the primary limiters on real-world risk: a site that does not grant untrusted users content-submission privileges is substantially less exposed. The specific injectable plugin parameter or setting is not detailed in the provided data beyond the general Stored XSS classification.

This is a moderate-severity Stored Cross-Site Scripting (CWE-79) issue rated CVSS 6.5. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable but NOT unauthenticated exploitation: PR:L confirms an attacker needs an authenticated low-privilege account (typical for WordPress stored XSS, e.g. a contributor/author who can submit content), and UI:R means a victim (often an administrator) must subsequently view the injected payload. The scope-change (S:C) reflects that script executes in the victim's browser session, outside the vulnerable component's security authority. No EPSS score, no CISA KEV listing, and no proof-of-concept flag were supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 6.5 rating is driven largely by scope change and low-impact-across-all-three CIA metrics rather than by ease or unauthenticated access; the authentication requirement and mandatory victim interaction meaningfully lower real-world priority. This is a legitimate issue to patch but not an emergency: treat as routine WordPress plugin hygiene unless the site allows untrusted contributor-level accounts. Note: the only reference is the Patchstack advisory (the reporter), so affected-version and impact details originate from a single source.

An attacker holding a low-privilege authenticated WordPress account (e.g. contributor) on a site running Rocket Lazy Load ≤ 2.4.0 submits content containing a malicious script payload that is stored by the plugin. When an administrator or other user later views the affected page in wp-admin or the front end, the script executes in their browser session, enabling session/cookie theft or actions performed as the victim. No public exploit code was identified in the provided data.